Developer tools · Docker run to Docker compose converter
Image tags vs digests: what the image: line in Compose points to
· Background
docker compose container-images
The image reference is the one line of a Compose file that points outside your machine. This post explains registries, namespaces, tags and digests, and why latest is a name rather than a promise.
Nothing changed and everything broke — the Compose file says image: app:latest and latest moved
Nothing changed and everything broke — the Compose file says image: app:latest and latest moved. Evidence: the positional image token is copied exactly to image. Reproduce image pinning with disposable literals. Pair each source occurrence with image scalar service key digest; reserve freshness and trust for destination review.
The container images incident also reveals that A separate container images incident boundary is that digest-bearing text is preserved without fetching or verification. Evidence: digest-bearing text is preserved without fetching or verification. This image pinning constraint is a stopping point. Inspect image scalar service key digest without manufacturing behavior, then document a host check for freshness and trust.
The parser preserves an image reference as text and derives a service name without validating registry syntax
Anatomy of an image reference — registry, namespace, repository, tag and optional @sha256 digest. Evidence: service-name derivation removes path tag and digest only for the local key; The parser preserves an image reference as text and derives a service name without validating registry syntax. Trace image pinning tokens into image scalar service key digest. Separate ordered values from last-value fields; freshness and trust is outside collection.
A related container images mechanism boundary is that for this container images section keep the original for this container images section command and warnings for this container images section beside this candidate file. Evidence: the repository gives no broader runtime or historical proof. Use this image pinning fact to predict one member or scalar in image scalar service key digest. Check warnings before deciding anything about freshness and trust.
Tag defaults and registry freshness require Docker or registry evidence outside this offline conversion
latest is just a tag — the default when none is given, with no guarantee of being the newest build. Evidence: no omitted tag is resolved and latest freshness is never decided; Tag defaults and registry freshness require Docker or registry evidence outside this offline conversion. Judge image pinning serialization from its model. Quoting in image scalar service key digest protects types but gives no operational proof for freshness and trust.
The second container images serialization observation is keep for this container images section the original command for this container images section and warnings beside for this container images section this candidate file that container images serialization result separates represented for this container images section configuration from absent context for this container images section image metadata is outside the container images serialization transformation. This image pinning output separates settings from unavailable context. Keep image scalar service key digest reviewable and check freshness and trust independently.
Digest pinning policy is not inferred; the converter carries the supplied reference unchanged
Digests as pinning — immutable references, how to find one with docker inspect, and what you give up in convenience. Evidence: digest-bearing text is preserved without fetching or verification; Digest pinning policy is not inferred; the converter carries the supplied reference unchanged. Stop at the image pinning exception instead of guessing. Any addition near image scalar service key digest needs a deployment-specific reason tied to freshness and trust.
Another container images exception constraint is that for this container images section keep the original for this container images section command and warnings for this container images section beside this candidate file. Keep the original image pinning command beside warnings. The comparison shows what image scalar service key digest contains and which freshness and trust decision remains manual.
Registry defaults and mirror behavior are outside the generated YAML subset
Registries and defaults — docker.io/library assumed for bare names, and the effect of mirrors. Evidence: registry defaults namespaces and mirrors are not implemented; Registry defaults and mirror behavior are outside the generated YAML subset. Build the image pinning example from synthetic names. Make every image scalar service key digest item traceable without exposing production freshness and trust details.
The same container images example sample demonstrates that for this container images section keep the original for this container images section command and warnings for this container images section beside this candidate file. The paired image pinning fact should be visible in image scalar service key digest. Record that line and avoid assumptions about freshness and trust.
Worked example: pinning a converted service — replacing postgres:16 with a digest reference and recording the tag in a comment
Worked example: pinning a converted service — replacing postgres:16 with a digest reference and recording the tag in a comment. Evidence: replacing postgres:16 with a digest is a manual policy action. Translate the image pinning consequence into one observable image scalar service key digest difference. Docker owns the later freshness and trust verdict.
The container images consequence implementation also shows A separate container images effect boundary is that the positional image token is copied exactly to image. Split image pinning responsibilities: conversion writes image scalar service key digest, the repository removes secrets, and operators validate freshness and trust.
What this does not cover — signing, SBOMs and vulnerability scanning
What this does not cover — signing, SBOMs and vulnerability scanning. Evidence: signing SBOM and vulnerability status cannot be inferred. Limit image pinning scope to image scalar service key digest branches shown here. Neighboring forms and defaults cannot answer freshness and trust questions.
One more container images scope limit follows from A separate container images limit boundary is that service-name derivation removes path tag and digest only for the local key. Evidence: service-name derivation removes path tag and digest only for the local key. Treat this image pinning boundary as an exclusion. Prefer accurate image scalar service key digest over guesses about freshness and trust.
Takeaway: the image line deserves a deliberate choice — and the converter carries your reference over unchanged for you to pin or not
Takeaway: the image line deserves a deliberate choice — and the converter carries your reference over unchanged for you to pin or not. Evidence: the unchanged image line gives reviewers a deliberate pinning point. Audit image pinning as source option, model field, image scalar service key digest line and warning. Remove secrets before checking freshness and trust.
Finally, the container images takeaway source confirms A separate container images decision boundary is that no omitted tag is resolved and latest freshness is never decided. Evidence: no omitted tag is resolved and latest freshness is never decided. Close image pinning narrowly: image scalar service key digest is a candidate; freshness and trust and shell equivalence are not guarantees.